New Corolla Security Rated as Poor

[Steve Whits]

According to Thatcham the new Corolla security is rated poor being susceptible to relay theft. The car industry says cars are more secure than ever yet thefts of modern vehicles is on the rise. 

Back to the discklock then!

[FROSTYBALLS]

Covered earlier today in the following - 

 

[oldcodger]

Well the ADAC list , January 19 , does not actually show the New Corolla, yet  on the tv news today it did say the New Corolla was one of the most vunerable.

https://dwkujuq9vpuly.cloudfront.net/news/wp-content/uploads/2019/01/Cars-tested-by-ADAC.pdf

One would hope Mr T is running around trying to find a fix that will be applied to all cars including those already sold,  for free.

@FrostyBalls  - will you be starting a new forum for the New Corolla ?

[FROSTYBALLS]

It was Thatcham Research who rated the Corolla's as being security from relay theft as being poor, not ADAC.

The ADAC list was included as the OP of the linked topic asked about other Toyota models.

No - a new forum isn't needed for the 2019 Corolla, as topics, etc can be contained within the existing Corolla forum.

 

[APS]

Note - it is only models with keyless entry that are vulnerable to relays (because they are constantly scanning for the presence and distance of a key fob)

Store your keys in a metal key locker overnight and/or in a 'faraday' pouch.

[estate]

Toyota GB answer to customers concerned about vehicle security is to take extra steps to secure their vehicle by purchasing signal blocking pouch for less that £10. So you purchase a £30,000 corolla and and spend an extra £10 to make it more secure, not fully addressing the problem.

[FROSTYBALLS]

35 minutes ago, estate said:

Toyota GB answer to customers concerned about vehicle security is to take extra steps to secure their vehicle by purchasing signal blocking pouch for less that £10. So you purchase a £30,000 corolla and and spend an extra £10 to make it more secure, not fully addressing the problem.

No different to any other manufacturer - some of which sell vehicles at far higher cost than the Corolla.

[Heidfirst]

42 minutes ago, estate said:

Toyota GB answer to customers concerned about vehicle security is to take extra steps to secure their vehicle by purchasing signal blocking pouch for less that £10. So you purchase a £30,000 corolla and and spend an extra £10 to make it more secure, not fully addressing the problem.

afaik you can disable the fob constantly transmitting (& therefore a relay theft) through a series of key presses & indeed if you wish you can disable the system on the car through the head unit. These however rely on humans doing so ...

[estate]

1 hour ago, FROSTYBALLS said:

No different to any other manufacturer - some of which sell vehicles at far higher cost than the Corolla.

The exception being the manufacturers that have a secure system fitted to thier vehicles. 

[estate]

1 hour ago, Heidfirst said:

afaik you can disable the fob constantly transmitting (& therefore a relay theft) through a series of key presses & indeed if you wish you can disable the system on the car through the head unit. These however rely on humans doing so ...

It's not really a friendly workaround, switching the keyless system off then on again. I think it's only ment if you want to disable it for long periods. 

There is far better security systems out there that have a better way of defeating this type of theft. 

[Heidfirst]

1 hour ago, estate said:

It's not really a friendly workaround, switching the keyless system off then on again. I think it's only ment if you want to disable it for long periods. 

That's on the head unit although some may want to disable it long term (you will still be able to set the alarm, lock/open the doors with the mechanical key & start the car by placing the fob against the start button).

As I said though you can disable the fob from constant transmitting by a simple key press procedure so do that when you park up at night.

[FROSTYBALLS]

1 hour ago, estate said:

The exception being the manufacturers that have a secure system fitted to thier vehicles. 

  .... Of which there are only a few. See the ADAC list in the following topic 

 

[estate]

28 minutes ago, Heidfirst said:

As I said though you can disable the fob from constant transmitting by a simple key press procedure so do that when you park up at night.

Not sure about this procedure Scott.

The only procedure that Toyota told me was what you also mentioned, but they say that only to disable the Smart Entry,  so it's not something you would be doing every time you use the car.

[estate]

33 minutes ago, FROSTYBALLS said:

  .... Of which there are only a few. See the ADAC list in the following topic 

 

Yes In read that report when it was published Mike.

I also read the Thatcham report and it points out that some carmakers have made significant strides in addressing keyless entry/start vulnerability, by either switching to a more secure wireless technology or introducing key fobs that go to sleep when idle. This demonstrates that there are solutions and fixes to the problem, which they expect other manufacturers to include on their future models. 

The technology is out there, other manufactures like Toyota just needs to address the vulnerabilities that exist.

[APS]

<ramble>

I could be harsh and I could be understanding towards car manufacturers. However, the reality is that the car industry is very competitive, margins are tight in the main stream market and security has not, and still (to some degree) does not feature very high on manufacturer's list of priorities. Only recently have manufacturers started to realise the sophistication of the adversaries they are facing. Developing truly secure systems requires plenty of skill and testing. Security expertise is still scarce and expensive, hence de-prioritised. 

Put yourself in the product manager's shoes; for the cost of developing a secure keyless entry, or hardened ECU isolated from the infotainment, you could develop a whole range of customisable body kit options. Which one would help you sell more cars?

 Relay attacks though, are not new and can be mitigated. As an example, when Apple designed the Apple Watch which communicates with an iPhone (including payment authentications for Apple Pay) it made sure the communication between the two devices was really secure and was not susceptible to a man-in-the-middle attack, which would include a relay device. Thus, the communication timing is measured accurately enough that the delay of messages introduced by a relay would be detected. Where there is a will, there's a way.

</ramble> 

[Heidfirst]

4 hours ago, estate said:

Not sure about this procedure Scott.

 

4 hours ago, estate said:

introducing key fobs that go to sleep when idle.

This is what Toyota have effectively done albeit it is manually initiated rather than a time-out - you can make arguments pro/con for either approach.

 

[duncerduncs]

I'm surprised that Toyota don't make it part of the vehicle handover from a dealer?  Lock the car, disable the key fob and walk away.  The next time you unlock the car with the key fob it returns it to being keyless....

It couldn't be simpler!

 

[estate]

7 hours ago, duncerduncs said:

disable the key fob and walk away.

I take it Bryan that the ability to disable the key fob is only available on the latest models (2018-19), if not what is the procedure?

[duncerduncs]

5 hours ago, estate said:

I take it Bryan that the ability to disable the key fob is only available on the latest models (2018-19), if not what is the procedure?

Press and hold the lock button on the fob whilst you press and release the unlock button twice.  This will stop the key from receiving the radio waves from the car, once you unlock the car using the fob (the smart entry wont work) it returns the key to normal.

[DeTomato]

I still reckon the best security is disabling the ignition yourself with a hidden kill switch. Used to work for me.

Otherwise, the good old steering lock is still a good deterrent and I still use one.

Thieves think twice if its going to take a lot of effort, but when all they need is to find the right "signal" it's a geeky challenge to make it interesting and profitable for the criminals. 

The problem with modern cars is they do not build in secure private and public key encryption to make each car to fob unique. But guess that's expensive, unless they used public key tokens which they won't want to do anyway because car manufacturers wouldn't want to trust them.